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CAPTURING  INDUSTRIAL  SECURITY  COSTS 

Standardization  of  Terminology  and  Procedures 
for  Tracking  Security  Costs  Within  Industry 


Abstract 

PURPOSE: 

The  purpose  of  this  study  is  to  validate  a  Security  Cost 
Questionnaire  developed  by  the  Resources  Working  Group  of  the 
National  Industrial  Security  Program.  The  Security  Cost 
Questionnaire  is  intended  to  be  used  to  gather  data  to  establish  an 
industrial  security  cost  baseline  and  which  can  be  used  as  a  metric  to 
validate  changes  brought  about  by  the  implementation  of  the 
National  Industrial  Security  Program 


SCOPE: 

This  report  summarizes  a  research  study  of  the  voluntary 
participation  of  Defense  contractors  in  the  collection  of  security  costs 
within  industry.  This  information  was  collected  during  individual 
interviews  with  financial  managers  and  security  professional  and 
from  comments  and  discussion  to  scheduled  presentations  to 
professional  groups.  The  study  encompasses  all  programs  that  fall 
under  the  Defense  Industrial  Security  Program  as  well  as  special 
programs  for  the  Department  of  Defense,  and  The  Central  Intelligence 
Agency.  The  Department  of  Energy,  the  remaining  signatory  to  the 
National  Industrial  Security  Program,  has  a  congressional  mandate  to 
report  security  costs,  and  therefore  is  not  addressed  in  this  study. 

FINDINGS: 

The  research  finding  reveal  that  there  exists  a  general 
objection  among  industrial  security  professional  associations, 
contractors,  specific  security  working  groups  concerning  the 
necessity  for  the  collection  of  industrial  security  costs,  skepticism 
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concerning  the  validity  of  any  cost  data  collected,  and  strong  concern 
over  the  sue  to  which  such  data  may  be  put.  Voluntary  participation 
in  future  cost  surveys  under  current  methodology  would  at  best  be 
sporadic  and  result  in  failure  to  establish  a  valid  cost  baseline 

RFCOMMENDATIQNS: 

Several  recommendation  are  made  that  should  be  considered 
prior  to  any  formal  cost  collection  effort.  Recommendations  are 
intended  to  promote  a  methodology  to  gather  valid,  pertinent  data 
and  obtain  the  highest  levels  of  corporate  interest  and  cooperation. 
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CAPTURING  INDUSTRIAL  SECURITY  COSTS 

Standardization  of  Terminology  and  Procedures 
for  Tracking  Security  Costs  Within  Industry 


INTRODUCTION 

A  primary  reason  for  the  implementation  of  the  National 
Industrial  Security  Program  (NISP)  was  to  realize  a  security  cost 
savings  through  an  efficient  and  cost  effective  security  program.  The 
NISP  was  implemented  with  the  signing  of  Executive  Order  12829 
(Federal  Register,  January  8,  1993,  PP.  3479-3483).  Executive  Order 
12829  mandates  the  collection  of  security  costs  for  government,  but 
not  for  industry.  Historically,  it  has  been  generally  held  both  in 
government  and  industry  that  to  effectively  measure  the  success  of 
the  NISP  an  accurate  industrial  security  cost  baseline  would  have  to 
be  established.  The  Resources  Working  Group,  one  of  eleven  working 
groups  of  the  NISP  Steering  Committee,  was  charged  with  developing 
procedures  to  capture  the  baseline  industrial  security  costs.  As  a 
result  of  these  efforts  several  cost  surveys  have  been  undertaken  to 
develop  a  usable  metric  for  future  changes  in  security  requirements. 
As  an  attempt  to  further  improve  the  methodology  for  determining 
more  specific  cost  data  related  to  the  NISP  implementation,  a  new 
Security  Cost  Questionnaire  was  developed.  As  there  is  no 
requirement  for  any  contractor  to  participate  in  any  cost  collection 
effort,  we  relied  on  voluntary  participation  in  validating  this  new 
questionnaire  was  sought.  The  objective  of  this  study  is  to  report 
industry's  acceptance  to  a  Security  Cost  Questionnaire,  and  to  make 
recommendations  concerning  any  further  industrial  security  cost 
collection  effort. 
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page  5,  December  1993). 


Based  upon  the  findings  of  the  prior  surveys  and  the  study 
(Industrial  Security  Costs,  J.  San  Miguel,  1993)  that  security  labor 
and  computer/facilities  costs  generally  account  for  90%  of  industrial 
security  costs  a  new  Security  Cost  Questionnaire  was  developed 
(Exhibit  A).  Tlie  questionnaire  asks  for  cost  data  for  security  labor 
and  for  computer  and  facilities  related  costs.  In  addition,  data  is 
requested  concerning  the  total  square  footage  of  the  physical  plant, 
the  number  of  employees  and  other  statistics  of  the  company  that 
would  be  used  to  interpret  the  cost  data. 

Executive  Order  12829  does  not  require  the  collection  of 
industrial  security  costs  within  industry.  Therefore,  participation  in 
this  study  was  elicited  on  a  voluntary  basis.  Since  polling  the  entire 
population  of  defense  contractors  would  be  prohibitively  time 
consuming  and  expensive  (circa  15,000),  the  "80/20"  rule  (  Page  22, 
Industrial  Security  Costs,  J.  San  Miguel,  1993)  was  applied.  The 
"80/20"  rule  suggests  that  20%  of  the  largest  defense  contractors 
account  for  80%  of  the  defense  contracts.  To  reduce  this  20% 
population  to  a  more  manageable  number  only  a  small  sampling  of 
the  20%  of  the  contractor  population  was  targeted  for  this  study. 

ORGANIZATIONS  CONTACTED 

In  order  to  gain  support  for  this  study  briefings  were  prepared 
for  professional  associations  and  specific  industrial  security  working 
groups  whose  members  were  among  the  senior  security 
managers/directors  of  "Corporate  America".  In  attendance  at  the 
professional  association  conference  were  the  representatives  from 
over  twenty  five  of  the  largest  defense  contractors  in  the  United 
States.  Briefings  presented  to  specific  industrial  security  working 
groups  were  attended  by  the  corporate  security  professionals  who 
were  in  positions  to  influence  policy  both  in  industry  and  in 
government.  One  group  that  received  the  briefing  were  security 
professionals  who  represented  the  major  professional  security 
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organizations  in  the  United  States.  The  support  of  these  associations 
is  recognized  as  mandatory  for  success  of  the  NISP.  During  these 
briefings  materials  concerning  the  background  of  the  security  cost 
collection  efforts,  the  objectives,  and  questionnaire  were  presented  to 
all  participants  for  comment  and  recommendations. 

Ten  senior  security  representatives  from  major  corporations 
participating  in  the  DISP  were  contacted  individually  and  their 
voluntary,  in  depth,  participation  in  this  study  was  solicited. 
Background  material  as  well  as  the  new  cost  questionnaire  was 
mailed  to  each  individual.  They  were  requested  to  review  the 
questionnaire  with  a  member  of  the  corporation's  financial  staff  with 
the  objective  of  determining  whether  or  not  the  definitions  provided 
were  clear  and  understandable,  and  if  the  questions  asked  and 
background  data  requested,  was  readily  retrievable.  Their 
comments,  suggestions,  and  recommendations  on  any  item  in  the 
questionnaire  were  also  solicited. 

Individuals  interviewed,  corporations  represented,  and 
professional  groups  who  participated  in  this  study  requested 
anonymity  and  confidentiality.  Accordingly,  sources  of  comments, 
suggestions,  recommendations  received  during  this  study  are  not 
identified. 

RFSUI.TS 

Comments  from  security  professional  and  corporate  managers 
shared  unanimous  agreement  that  the  proposed  questionnaire,  as 
designed,  could  not  provide  valid  data  to  establish  an  industrial 
security  cost  baseline.  The  consensus  of  opinion  is  that  the  three 
items  related  to  security: 

What  is  your  best  estimate  of  the  cost  of  security  as  a 

percentage  of  total  FY  9 _ revenues  from  government 

contracts? _ % 
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For  FY  9 _ please  enter  the  total  amount  (in  thousands) 

of  security  personnel  costs:  $ _ K. 

For  FY  9 _ please  enter  the  total  amount  (in  thousands) 

of  security  facilities  and  equipment  costs: 

$ _ K. 

are  too  general,  and  the  other  information  requested  is  considered 
irrelevant.  Many  individual  contacted  expressed  a  strong  mistrust  of 
the  motives  for  such  a  survey,  and,  consequently  were  reluctant,  or 
refused  to  provide  the  data  requested.  Generally,  questions  and 
concerns  raised  in  this  area  were: 

"Who  will  distribute  the  questionnaire?" 

"To  whom  will  it  be  distributed?" 

"How  will  the  responses  be  documented?" 

"How  will  the  material  (proprietary  material)  be 
protected?" 

"What  is  the  possibility  it  could  be  used  adversely  against 
their  organization  in  a  government  audit?" 

Basically,  there  is  an  overall  unwillingness  to  provide  the  data 
requested  on  a  voluntary  basis  especially  as  the  Executive  Order 
specifically  does  not  require  it. 

There  was  also  a  general  agreement  that  previous  such 
surveys,  extrapolating  data  from  a  relatively  minor  segment  of  the 
industry  were  invalid.  There  were  two  principle  reasons  expressed; 
one,  that  the  approved  cost  accounting  procedures  inextricably 
intertwined  security  and  non  security  related  costs,  and,  accordingly, 
reliable  data  regarding  the  former  were  difficult  to  extract;  and,  two, 
the  extrapolation  procedure  used,  since  it  was  not  based  on  precise 
information,  tended  to  magnify  any  errors  in  the  original  data  base. 


9 


Another  question  posed  by  several  individuals  is  that 
advantage  is  there  for  industry  to  participate  in  any  survey  that  will 
subject  them  to  additional  scrutiny. 

On  the  positive  side,  there  was  some  interest  in  capturing 
security  costs.  However,  the  recommended  approach  is  somewhat 
different  that  those  attempted  in  the  past.  The  first  step  would  be 
an  attempt  to  get  top  managers  from  key  industries  to  agree  to  work 
with  government  representatives  to  design  the  form  that  they  can 
use  to  capture  their  true  security  costs.  This  would  be  an  Industry 
dominated  forum.  In  addition,  there  would  have  to  be  reasonable 
guarantees  that  any  information  or  data  provided  "would  not  come 
back  to  bite  them".  The  composition  of  such  a  work  group  would 
primarily  be  comptroller  and  other  finance  and  accounting 
professionals.  Many  persons  contacted  agreed  that  the  security 
professional,  while  they  should  have  some  input,  are  not  the  people 
to  ask.  The  accounting  professionals  are  more  likely  to  be  able  to 
retrieve  the  requested  data;  especially  in  those  organizations  where 
Security  is  not  a  separate  "line  item". 

The  suggested  approach  would  be  for  the  working  group  to 
determine  specific  key  indicators  in  the  NISP,  and  gather  data  only 
on  those  specific  items.  After  analysis,  another  survey  could  be 
undertaken  in  a  reasonable  time  (two  years)  to  compare  costs. 
Surveys  conducted  on  a  annual  basis  were  felt  to  be  entirely  too 
burdensome. 

While  there  was  some  agreement  that  such  a  survey  would 
provide  some  data  on  the  impact  of  the  NISP,  this  would  have  to  be 
tempered  with  the  reductions  in  cost  already  being  accomplished 
under  improved  quality  management.  Cost  citing  innovations  cited 
included  industry  mergers  and  internal  consolidations,  resulting  in 
fewer  middle  management  and  lower  level  positions. 

There  were  some  comments  that  the  work  group,  rather  than 
be  organized  on  a  ad-hoc  basis,  could  be  formed  from  a  committee  of 
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an  already  established  professional  association. 

TTie  question  concerning  whether  or  not  the  charging  of  the  time 
needed  to  complete  any  voluntary^  cost  survey  would  be  an  allowable 
charge  by  government  auditors  was  also  raised.  Additional 
comments  expressed  over  this  issue  were  of  the  nature  that  most  in 
industry  felt  that  they  had  devoted  sufficient  "free  time"  in 
completing  other  surveys,  and  that  their  management  would  not  be 
favorably  inclined  to  participate  in  yet  another  "voluntary"  survey. 

Finally,  there  was  considerable  concern  that  this  survey  could 
cause  some  unwelcome  attention  from  top  corporate  management 
regarding  the  cost  of  security  in  an  environment  already  felt  to  be 
"cut  to  the  bone". 


mNCLUSTON 

As  predicted  by  an  earlier  study  ( Industrial  Security  Costs,  J. 
San  Miguel,  August  31,  1993),  this  questionnaire  was  not  acceptable 
to  contractors.  It  appears  that  voluntary  participation  by  industry  in 
any  cost  survey,  under  current  methodology,  will  not  be  successful. 
However,  comments  from  industry  representatives,  indicate  that  an 
attempt  to  obtain  this  kind  of  data  could  be  feasible  if  the  effort  was 
seen  as  industry  driven.  That  is,  if  a  true  "Partnership  with 
Industry"  concept  could  be  implemented,  where  the  government 
representative  would  be  viewed  as  a  peer  rather  than  a  threat.  In 
addition,  for  this  effort  to  be  successful,  it  appears  fro  comments  and 
discussion  with  industry  representatives,  that  there  will  have  to  be 
some  advantage  to  both  participants;  Government  and  Industry. 
Industry  participants  will  have  to  understand  why  the  data  is 
needed  and  "What's  in  it  for  them". 

The  three  alternatives  to  this  approach  would  be: 

•  To  continue  the  frustrating  and  time  consuming  practice 
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of  trying  to  capture  data  under  current  methodology. 

•  To  discontinue  working  with  industry  to  capture  the  data. 

•  To  mandate  the  reporting  of  security  costs  by  regulatory 
changes. 

It  is  noted  that  past  studies  have  also  shown  that  the  cost  of 
security  ( 1%  and  9%)  remain  generally  constant.  The  costs  within 
those  percentages  for  security  labor  and  facilities  and  computer  costs 
also  generally  remain  constant.  There  is  presently  a  surplus  of 
defense  contractor  facilities  or  space.  It  was  voiced  that  these  should 
be  not  significant  facilities  cost  within  the  foreseeable  future.  Any 
cost  savings,  other  than  for  downswing  due  to  the  decline  in  defense 
contacting  and  quality  management  initiatives,  will  be  realized  from 
the  "embedded"  costs  of  security. 


RFCOMMENDATIONS 

Establish  the  office  that  will  be  responsible  for  the  distribution 
of  the  cost  questionnaire,  receipt  of  the  data,  and  dissemination  of 
the  product.  The  charter  for  this  office  should  detail  how  the  data 
will  be  protected  and  how  it  will  be  disseminated  to  protect  the 
confidentiality  of  the  data  and  the  organizations  providing  the  data. 

Through  a  joint  industry/ government  working  group, 
encompassing  top  management  in  both  finance  and  security, 
establish  a  list  of  those  areas  felt  to  be  the  cost  drivers  in  the 
industrial  security  program.  These  cost  drivers  will  be  the  basis  for 
any  subsequent  cost  survey.  A  possible  body  to  undertake  this 
effort  is  the  Resources  Working  Group  of  the  NISP. 

Eliminate  questions  in  the  survey  that  are  irrelevant  to  cost 
collection,  i.e.,  square  footage  in  a  plant. 

Design  and  address  any  future  efforts  to  comptroller  and 
financial  professionals  as  well  as  security  professional  in  industry. 
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Consider  establishing  a  "Award"  for  industry  participants.  In 
order  to  be  effective  this  would  have  to  be  a  prestigious  recognition, 
similar  for  Total  Quality  Management  award,  possibly  presented  by 
the  Secretary  of  Defense  to  the  Chief  Executive  Officer  of  the 
corporation. 

Make  no  further  efforts  to  distribute  or  utilize  the  present 
Security  Cost  Questionnaire. 


13 


REFERENCES 


Executive  Order  12829,  The  President,  National  Industrial 
Security  Program,  Federal  Register.  January  8, 1993,  pp.  3479- 
3483. 

Mattice,  Lynn,  Security  Cost  Survey,  Aerospace  Industries 
Association,  1989. 

NISP  Resources  Working  Group,  National  Industrial  Security 
Program  Security  Cost  in  Industry  Survey  for  Fiscal  Year 
1990,  June  1991. 

Secret  of  Defense,  The  National  Industrial  Security  Program: 

A  Report  of  the  President,  Washington,  DC,  November  1990. 

San  Miguel,  Joseph  G.,  Industrial  Security  Costs:  AN  ANALYSIS 
of  Reporting  Practices,  Naval  Postgraduate  School,  Monterey,  CA 
August  31,  1993. 

Resources  Working  Group,  Capturing  Security  Costs  in  Industry: 
Final  Report  and  Recommendations  of  the  National 
Industrial  Security  Program  Resources  Working  Group, 
December  1993. 


14 


Exhibit  A 


SECURITY  COST  SURVEY 


The  purpose  of  this  survey  is  to  gather  cost  information  on 
security  costs  related  to  work  performed  for  the  federal  government. 
This  information  is  necessary  for  identifying  the  total  amount  of 
industrial  security  costs  that  is  being  incurred  annually  by  the 
private  sector.  In  addition,  background  information  on  your 
company's  operations  is  requested. 

DEFINITIONS 

Fiscal  Year  ( FY)  Please  indicate  the  calendar  dates  (  a  current 
twelve  month  period)  used  in  your  company's  accounting  year. 

Personnel  Costs  This  includes  salary  and/or  other  payments 
related  to  those  personnel  who  are  hired  for  security  and  whose 
primary  functions  are  security  related.  The  total  dollar  amount 
given  for  the  year  should  be  the  burdened  figure  (i.e.,  includes 
overhead,  G&A,  fringes,  etc.). 


Facilities  &  Equipment  Costs  List  only  that  equipment  and/or 
facility  improvements  for  which  a  valid  security  requirement  exists 
(e.g.,  a  stand-alone  personal  computer  had  to  be  purchased  for 
accounting  that  could  not  be  performed  on  an  unclassified  system  or 
on  a  normal  corporate  network  due  to  a  security  requirement).  For 
capitalized  assets,  include  the  annual  depreciation  or  amortization 
costs.  For  non-capitalized  facilities  and  equipment  include  lease,  rent 
or  purchase  costs.  Installation  and  maintenance  costs  should  be 
included. 


COMPANY  BACKGROUND 

Total  FY  9 _ sales  revenue _ .  Total  FY  9 _ number  of 

employees _ . 

Total  FY  9 _ federal  government  payment  to  your  company  on 

government  contracts _ . 

For  FY  9 _ ,  of  the  total  level  of  labor  in  your  company,  what 


15 


percentage  was  funded  by  government  contracts  in  FY  9 _ ? _ %. 

How  many  square  feet  of  space  (regardless  of  use)  is  currently 
available  to  support  government  activities? _ Sq.  Ft. 

What  percentage  of  your  company's  government  contracts  is  service 
oriented _ %,  and  what  percentage  is  manufacturing _ % 

What  is  your  best  estimate  of  the  cost  of  security  as  a  percentage  of 
total  FY  9 _ revenues  from  government  contracts? _ % 


REPORT  OF  COSTS 

For  FY  9 _ please  enter  the  total  amount  (in  thousands)  of  security 

personnel  costs:  $ _ K. 

For  FY  9 _ please  enter  the  total  amount  (in  thousands)  of  security 

facilities  and  equipment  costs:  $ - K. 


COMMENTS  AND  SUGGESTIONS 

Please  provide  any  comments,  suggestions,  questions,  explanations  or 
additional  information. 
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EXHIBIT  B 


COLLATERAL  SECURITY  COSTS 
AS  A  PERCENTAGE  OF  TOTAL 
OPERATING  COSTS 


1  % 


9  9% 


■  TOTAL 
OPERATING 
COSTS 

□  TOTAL 
SECURITY 
COSTS 


EXHIBIT  C 


COLLATERAL  SECURITY  COSTS 
AS  A  PERCENTAGE  OF  TOTAL 
OPERATING  COSTS 


1  % 


9  9% 


■  TOTAL 
OPERATING 
COSTS 

□  TOTAL 
SECURITY 
COSTS 
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EXHIBIT  D 


BLACK  SECURITY  COSTS  AS  A 
PERCENTAGE  OF  TOTAL 
OPERATING  COSTS 

9% 


L  J 


91  % 


EXHIBIT  E 


SECURITY  COSTS  (BLACK) 


1  0% 
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